# Ordent

> Ordent is your risk team, as a service. Send events (signup, login, payment, withdrawal); every user gets risk tags from the first request to the last, and every tag comes with a suggested action. Choose how much to delegate: Advise, Recommend, or Autopilot. Self-serve, $99 a month, built for digital businesses that move money. Ordent does not do identity verification or AML; it routes only the users who need it to a verification partner.

Ordent turns entropy into order.

## Start here

- [How it works](https://ordent.io/how-it-works): one event in, one decision out. Detect, decide, act.
- [Docs](https://ordent.io/docs): quickstart and install with your AI agent; reference sections for events, tags, policies, modes, webhooks, widget, labels, sandbox and SDKs.
- [Pricing](https://ordent.io/pricing): Signals $99, Service $399, Risk Team from $2,000. Billed per user event, never per verification. 14-day refund, sandbox before you pay.
- [Start](https://ordent.io/start): get a sandbox key.

## Products

- [Signals](https://ordent.io/products/signals): device intelligence, signup intelligence (email, phone, IP), behavior, actor type (human, bot, AI agent).
- [Graph](https://ordent.io/products/graph): user timeline, clusters, labels, the cross-merchant network.
- [Decisions](https://ordent.io/products/decisions): tags and actions, policies and custom tags, Autopilot, step-up widget, ops panel, KYC routing, AI analyst and weekly report.
- [AI agents](https://ordent.io/agents): build with agents (MCP server, llms.txt, runtime calls) and decide about agents (actor tags, verified agents, agent policies).

## Use cases

- [Fake signups](https://ordent.io/use-cases/fake-signups)
- [Multi-accounting and bonus abuse](https://ordent.io/use-cases/multi-accounting)
- [Account takeover](https://ordent.io/use-cases/account-takeover)
- [Card testing and chargebacks](https://ordent.io/use-cases/card-testing)
- [Crypto exchanges](https://ordent.io/industries/crypto)
- [Fintech](https://ordent.io/industries/fintech)

## Insights

- [Why we give you tags, not a score](https://ordent.io/insights/tags-not-scores): A risk score tells you a number. A tag tells you what happened, how sure we are, and what to do next. Here is why Ordent is built around tags, and what that changes for a team without a fraud analyst. (Field Notes, September 23, 2026)

Full text of every post: https://ordent.io/llms-full.txt. Feeds: https://ordent.io/insights/rss.xml, https://ordent.io/insights/feed.json.

## Integration in one line

```ts
import { Ordent } from "@ordent/sdk";
const ordent = new Ordent({ apiKey: process.env.ORDENT_KEY });
const { decision, tags } = await ordent.events.send({ type: "signup", user: { id, email }, device: req.ordentDevice, ip: req.ip });
if (decision === "step_up") return widget.render({ user: id });
```

Decisions: allow, step_up, review, block, kyc. Modes: advise (you act), recommend (default; we queue edge cases), autopilot (we act, reversible, logged). Tag families: email.*, phone.*, ip.*, device.*, velocity.*, cluster.*, promo.*, payment.*, card.*, actor.*, agent.*, network.*, kyc.*, custom.*.

## Trust

- [The network](https://ordent.io/network): what leaves your account and what doesn't. Keyed hashes, anonymity threshold, give-to-get, cascading deletion.
- [Manifesto](https://ordent.io/manifesto) and [About](https://ordent.io/about).
- Security contact: https://ordent.io/.well-known/security.txt

## Optional

- [Design partners / Risk Team tier](https://ordent.io/design-partners)


---

# Why we give you tags, not a score

Source: https://ordent.io/insights/tags-not-scores
Rubric: Field Notes
Author: Ordent team
Published: September 23, 2026

A risk score tells you a number. A tag tells you what happened, how sure we are, and what to do next. Here is why Ordent is built around tags, and what that changes for a team without a fraud analyst.

Every fraud vendor returns a score. Ordent returns a score too, but we treat it as a footnote. The thing we actually want you to read is the list of tags underneath it.

This post is about why.

## A score is an answer to the wrong question

A risk score answers "how suspicious is this user, on a scale?" That is a reasonable question for a fraud analyst who reads scores all day and has a feel for what 81 means on this product, this month, with this traffic.

Most of the businesses we work with do not have that person. They have an engineer who shipped signup last week and wants to know one thing: **what should the code do now?**

A score does not say. Eighty-one could mean "a bot from a datacenter" or "a real customer on a hotel VPN". The right action is different in each case, and the score erased the difference on its way to becoming a number.

## What a tag carries

A tag is a fact about the user, with three things attached:

```jsonc
{ "tag": "email.disposable", "confidence": 0.99, "action": "require_phone" }
```

- **The fact.** `email.disposable` means the email domain is a throwaway service. Not "risky", not "suspicious": a specific thing we observed.
- **How sure we are.** Confidence is per tag, not per user. We can be certain about the email and unsure about the device at the same time, and you can set different thresholds for each.
- **What to do.** The suggested action comes from the policy preset for your vertical. It is a default you can override, not a verdict.

Tags also accumulate. A user who looked clean at signup and starts sharing a device with a banned account six months later gets `device.shared_with_banned` on the day it happens, with the event that produced it. The timeline is the record of everything we ever learned about that user, in order.

## Why this matters for a small team

Three practical consequences.

**You can explain every decision.** When support asks why a withdrawal was held, the answer is a list of tags, not "the model said 0.81". The user can be told "confirm your phone number", because the tag says so.

**You can delegate selectively.** Autopilot on `card.testing_pattern` is an easy call: the pattern is unambiguous and the cost of a false positive is one retry. Autopilot on `cluster.size_5plus` is a harder call, because clusters have legitimate explanations (a family, an office). Tags let you hand over the first and keep the second on review. A single score would force you to pick one setting for everything.

**Your feedback lands somewhere specific.** When you report `false_positive` on a user, we know which tag was wrong, and the threshold for that tag on your account moves. A score would have to absorb the correction into a model you cannot see.

## What we lost, and why we kept the score anyway

Scores are convenient for one thing: sorting. A review queue ordered by score is easier to work than one ordered by "number of tags". So the score stays in the response as `risk.score` and `risk.band`, and the review queue uses it.

But the score is derived from the tags, never the other way around. If you only read one field, read `decision`. If you read two, read the tags.

## Try it

Send one signup event from the sandbox and look at the response. The tags will tell you more about that user than any number could.

```ts
const { decision, tags } = await ordent.events.send({
  type: "signup",
  user: { id: user.id, email: user.email },
  device: req.ordentDevice,
  ip: req.ip,
});
```

[Get a sandbox key](/start), or read [how it works](/how-it-works) first.